Hi and welcome back to another episode on How to Hack.
So over here we have open Web application security project juice shop running.
So once we're on this vulnerable Web application server, we can do all of our testing against the server.
So on a top right corner, we have a couple and we can do a login directly to any account.
So one thing that we want to introduce and learn today is about web developer option so we can click
on to the top right corner.
We can click on a web developer and we can click on toggle.
So once we're entitled TOS, we'll be able to see all the different tools that we have.
So we have Inspector, which can help us inspect elements of a website to understand more about a site.
We have a console which tells us about the items and activities that are happening onto the web developer
and we have debugger.
All right.
So to Duboc, more information so we can look at the JavaScript information that are being loaded.
So we also did a Minifie item.
So we actually try to demystify the JavaScript so that it becomes human readable and we can try to segment
out which already pages.
So we learn about how to access some of this items within the Java script.
And a really important part is on network.
So Network actually help us understand what kind of application programming interfaces could have been
kalt and what kind of data data being transacted between the Web application server and your Web browser.
So of course we did a earlier tutorial about SQL injection.
So over here we can see there was a email field so we can go ahead and actually enter a single quote
or one equal one and we can just enter whatever password we won.
And of course we can click on login and we will login successfully as an admin account.
OK, so this is the first roll that is actually being quarried by the database.
When we tried to do a login, which is why we ended up with this particular account moment, we tried
to log in.
So once we're in, we can see, for example, we have a who am I?
So we have the response and we have all this different data.
So we manage to get some token.
We get to you ML as well.
All right.
So we can see all this data and information that are being sent to us and we even get the IP address
that is also being sent over.
OK, so we get all this different data, all this different information.
All right.
So we can seed the method, whether it's a get or whether it is a post of information.
All right.
So all these are very important points to understand about what's happening.
So the next thing that we want to look at is in terms of understanding about the account details.
So, for example, over here, if I click on their account and I click under all this and Paghman and
if I click on Save Address, for example, I can again go into web developer.
Right.
And we can click on network.
And again, we can try to reload the site so we can actually do a refresh and we can see the kind of
information that are being followed to us from the Web application server.
All right.
So we can click on address and we can see some information.
All right.
So we can click on, for example, response.
So we have the mobile number over here, which is actually not being shown.
All right.
We can get the mobile number.
We can get the zip code that is also being shown here.
We have tast and so on, so forth.
All right.
So very quickly, we can find out all these different items.
So we found the hidden mobile number that is actually not here at all.
OK, so the next thing we can try to do is also click on a cow, click under orders and Paghman and
we can click under these payment options.
So you click on payment options.
What you can see here is we have all this asterisked it actually Moscow, the first 12 characters of
a credit card.
So in our case, we are only seeing the last four digits of the credit card.
This is a gain for security purposes and for all these different details.
So we can see the name and we can see all this different data.
So what we can do, because as a result of looking at a network traffic that's being sent in and out
between the Web browser as well as the Web application server, we can also trying to find out what
are the exact credit card details.
And if I click over here on the cards immediately, if I zoom in a little more, we can see the actual
cut numbers and we see the ending is four, three, six, eight.
So this coincides with the safe cars that we have over here.
So immediately we can find all those details and data.
All right.
And likewise, for the second credit card, we are also able to find out the full credit card details
and why is that the case?
The reason is because a lot of times the Web application server.
All right.
So whether it is a off the shelf web application server or whether it is a custom built from ground
up from ground zero, whatever the case is, sometimes the developers may have coded the credit card
details.
Or some data or information is being sent from the Web application server into the Web browser, and
what we do is that the only changed a value later on using JavaScript, which means that we actually
get the full data into our browser and our browser will manipulate the display into asterisks.
And that is why we're able to see it through the use of network tap on the web developer.
So once again, I hope you've learned something valuable in today's tutorial.
And if you like what you watch, remember to like, share and subscribe to channel so that you can be
kept abreast of the latest cyber security.
Thank you so much once again for watching.